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Amendments to the Claims : 

This Listing of Claims will replace all prior 
versions, and listings of claims in the application. 

Listing of Claims : 

Claims 1 (Canceled) . 

Claim 2 (Currently amended) : A method as claimed in claim 
4-7, wherein the step of identifying data relating to 
relevant server protocols comprises: 

for each communication included in the received data, 
comparing the data transfer protocol with at least one 
predefined server protocol, and 

when the comparison results in a match, identifying 
the corresponding received data as relating to a relevant 
server protocol. 

Claim 3 (Original) : A method as claimed in claim 2, 
wherein the step of identifying further includes marking 
the identified data. 

Claims 4-6 (Canceled) . 

Claim 7 (Currently amended) ; A method ao claimed in claim 

— further comprising: for identifying a device acting as a 
server o n a network, the method comprising: 

receiving data representing communications on the 
network , the data containing source device, destination 
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device, data transfer protocol and data volume information 
for communications represented therein; 

identifying, from the received data, data relating to 
one or more relevant server protocols ; 

sing the identified data, determining as a server 
device, the device which has the highest data volume for 
communications in which it is the source or destination 
device and in which at least a threshold number of other 
i^^s are involved; 

after the step of identifying data relating to 
relevant server pr otocols, identifying the devices involved 
in the communications represented in the identified data 
using the source device and destination device information, 
and for each identified device, determining the total 
volume of data transferred during communications 
represe nt ed in the identified data involving the device 
using the volume information; 

after the step of determining the total volume of data 

transferred for each device, identifying the device with 
the highest total volume; 

after the step of identifying the device with the 

highest total volume, determining the number of other 
devices involved in communications, represented in the 
identified data, with the identified device; 

after the step of determining the number of other 
devices, comparing the determined number against a 
predetermined threshold number, and if the determined 
number exceeds the predetermined threshold number, 
determining that the identified device with the highest 
total volume is a server device. 
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Claim 8 (Original): A method as claimed in claim 1, 
further comprising : 

removing data representing communications involving 
the determined server device from the identified data. 

Claim 9 (Original): A method as claimed in claim 8, 
wherein the step of removing comprises unmarking the data. 

Claim 10-21 (Canceled) . 

Claim 22 (Currently amended) : A computer p ro gram qo 
claimed in claim 21, further comprising: On a computer 
readable medium, a computer program comprising: 

program means for receiving data representing 
communications on the network, the data containing source 
device, destination device, data transfer protocol and data 
volume information for communications represented therein; 

program means for identifying, from the received data, 
data relating to one or more relevant server protocols, and 
program means for using the identified data, determining as 
a server device, the device which has the highest data 
volume for communications in which it is the source or 
destination device and in which at least a threshold number 
of other devices are involved; 

whe rein the program means for determining as a server 
device further comprises: 

pr ogram means for identifying, after 
identifying data relating to relevant server 
protoco Is, the devices involved i n the 
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coxniaunications represented in the identified data 
using the source device and destination device 
information, 

program means for determining, for each 
id entified device, the total volume of . data 
transferred during communications represented in 
t he i dentified data involving the device using 
the volume informations- 
program means for identifying, after said 
determining, the total volume of data transferred 
f or each device, the device with the highest 
total volumes- 
program means for identifying, after said 
determining, the total volume of data transferred 
for each device, the device vjith the highest 
total volume; and 

program means for determining, after said 
identifying, the device with the highest total 
volume the number of other devices involved in 
communications, represented in the identified 
data, with the identified device; 
program means for comparing, after said determining 
the number of other devices, the determined number against 
a predetermined threshold number, and 

program means for determining, if the determined 
number exceeds the predetermined threshold number, that the 
identified device with the highest total volume is a server 
device . 
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Claim 23 (Original) : A computer program as claimed in 
claim 22, further comprising: 

program means for removing data representing 
communications involving the determined server device from 
the identified data. 

Claim 24-28 (Canceled) . 
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